Enrique Blanco

The laziest programmer at Microsoft...

Enrique Blanco — Thu, 18 Nov 2010 20:53:00 GMT

… was the one that make this “feature” –> Use a dedicated web front end computer for crawling:

You can think: “Oh that’s cool so I can derive all the crawling load to a single server and take it out of the NLB so the public facing servers don’t get affected by the crawler overhead”.

And I will say “Fuck Yeah! That’s true! It can be really useful when you have a really tough indexing needs but…”

The “but part” is that a programmer that respects him/herself MUST find a better way to accomplish this than writing on the index server’s hosts file your farm NLB name pointing to that server IP!!!.

Then one happy day in your moss paradise… some other application you’ve just installed in the server starts failing (in my case some Veritas stuff) and after a few minutes/hours/attempts/insults/frustration you realize that the cause is a line like this in your hosts file:

192.168.1.105 www.myportal.com # Added by Office SharePoint Server Search (7/30/2010 8:28 PM).

So, here’s the solution, simply don’t use that feature. Yeah I know that adding the feature only took… ten minutes? but if you take into account all the hours this crap has taken all over the world...

And please, Lazy Programmer at MS, take your job more seriously. Every time someone like you makes stuff this crappier, god kills a kitten.

Cannot run Code Metrics over a SharePoint Visual Studio Project

Enrique Blanco — Wed, 17 Nov 2010 23:24:10 GMT

As you know Visual Studio (in some editions) has a code metrics analyzer that helps you identifying weak spots in your code design (excessive number of lines, cyclomatic complexity,..) and gives you a general maintainability index for your projects.

Yesterday I tried to run the test over some SharePoint projects and it crashed with this error:

Message: An error occurred while calculating code metrics for target file 'Meh.SedeV1.Modules.dll' in project Meh.SedeV1.Modules. The following error was encountered while reading module 'Microsoft.SharePoint': Could not resolve type: T ObjectModel

After looking for a solution for a while I found that if your project references “Microsoft.SharePoint.dll” then, in order for the code metrics to run, you must also reference “Microsoft.SharePoint.Security.dll”.

Add that reference to your project and it will work.

Enabling IE9 Platform Preview 6 user interface

Enrique Blanco — Tue, 09 Nov 2010 11:06:16 GMT

When I downloaded IE9 Beta I had a very annoying problem with it, it didn’t show my iGoogle page the right way . With the Platform Preview 6 release that was fixed, but it lacked a proper user interface. I did not know why it didn’t get the beta UI since the beta was already out, but it left the PP6 almost unusable for everyday use (yes, I know it is not intended for that).

Well the main point is that I really wanted to use IE9, the more you use beta/PP versions the more info the development teams have, and the best product they made.

And I found this Ars Technica article showing how to give the PP6 the Beta UI:

Install IE9 Beta on your machine. You can download IE9 Beta from www.beautyoftheweb.com

Install Internet Explorer Platform Preview 6. You can download Platform Preview 6 from www.ietestdrive.com

Create a folder on your Desktop called IE9_PP6

Copy the iexplore.exe file from the C:/Program Files/Internet Explorer directory (or C:/Program Files (x86)/Internet Explorer if you are on a 64 bit machine) to the IE9_PP6 folder

Create a folder inside IE9_PP6 called iexplore.exe.local (Note: It is imperative that you name this folder exactly as specified)

Navigate to the Internet Explorer Platform Preview directory within Program files (commonly on 32 bit machines this will be at C:/Program Files/Internet Explorer Platform Preview and on 64 bit machines this will be at C:/Program Files (x86)/Internet Explorer Platform Preview)

Copy the contents of the iepreview.exe.local folder within the Internet Explorer Platform Preview directory to the iexplore.exe.local folder within IE9_PP6

Close all instances of IE running on your machine and run iexplore.exe from IE9_PP6

And that’s all, Here is the difference with my Google tasks pane before and after using PP6, quite a difference!

Hope it helps!

ASP.NET Security Advisory 2416728 Vulnerability. Some links

Enrique Blanco — Tue, 21 Sep 2010 23:25:53 GMT

I’m trying to get some useful links regarding the 0-day exploit discovered in ASP.NET

This is the official MS note: https://www.microsoft.com/technet/security/advisory/2416728.mspx
This is a video of an attack to a DotNetNuke Test Site: http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html
This is a FAQ from ScottGu: http://weblogs.asp.net/scottgu/archive/2010/09/20/frequently-asked-questions-about-the-asp-net-security-vulnerability.aspx

TEMPORARY SOLUTIONS:

This is the first post I read from ScottGu: http://weblogs.asp.net/scottgu/archive/2010/09/20/frequently-asked-questions-about-the-asp-net-security-vulnerability.aspx
Some info regarding Sharepoint specifically: http://blogs.msdn.com/b/sharepoint/archive/2010/09/21/security-advisory-2416728-vulnerability-in-asp-net-and-sharepoint.aspx
This is an http module to patch your applications until the fix is released: http://oraclebugfix.codeplex.com/

Implement the fix ASAP!!

Hope it helps!!

MOSS cache with different Alternate Access Mappings

Enrique Blanco — Wed, 08 Sep 2010 20:47:02 GMT

This is something very similar to the issue I found when I realized that MOSS cache does not distinguish between http and https. Today I realized that in my setup moss does not distinguish between hostnames.

The situation is this:

I have a web application that must be accesed by more than one hostheader, I don’t want to do complex things such as extending the app and so, in part because the application must be accesible over https and host headers and SSL don’t work very well on the same IP.

So I setup the AAM in this way:

Default: portal.domain.aaa
Extranet: external1.domain.es
Internet: external2.domain.com

So you can access the same portal by the three addresses (as long as you configure the hostheaders in the front-ends) without any extended web applications.

The problem was:

While doing the testing we saw that the search results when we accesed portal.domain.aaa were actually pointing to portal.domain.aaa document and pages, but when we switched to the other addresses the absolute links in the page and the search results were still pointing to the portal.domain.aaa address! If we visited a page that was not visited before everything worked ok.

The solution:

As we did with the http/https cache issue, we modified the module that implemented the “VaryByCustom” method and added the hostname to the string that this method returns, so every hostname has its own copy of the page in the cache.

Hope it helps!

Parameterized tests with Pex.

Enrique Blanco — Sun, 28 Mar 2010 17:45:22 GMT

Until now all we did was letting Pex do the automatic testing, that is letting it look for unwanted-erroneous exceptions in out code, but we did not “instruct” it to check the logic in our code. No we are going to complete some of the tests to check it by the means of using asserts and assumptions.

First of all, let’s see how Pex generates the tests for this method (you can see that we added the preconditions using Pex for it):

  public int MethodToBeTested (int i, int j) 
        {
            // <pex>
            if (j == 0)
                throw new ArgumentException("j == 0", "j");
            if (i == int.MinValue)
                throw new ArgumentException("i == int.MinValue", "i");
            // </pex>
            return i / j;
        }
 

When you write a test like this:

 [PexMethod]
public int MethodToBeTested(
    [PexAssumeUnderTest]ClassToBeTested target,
    int i,
    int j
)
{
    
    int result = target.MethodToBeTested(i, j);
 
    return result;
    
}
 

What you are really writing is some kind of test template, then Pex analyses the code of the method and constructs an input table based on your code, choosing the values of the parameters that can be “interesting”. In the Pex exploration you can see the values it has chosen:

So, once it has the code and the values for the inputs, it generates the actual tests, you can see them in the solution explorer as associated files of the “main” test file, it generates a single file for each [PexMethod] attributed method in the file:

So if we open one of this tests you’ll see that the tests generated are standard visual studio tests (if you selected this test framework) and also they feed the methods with the inputs shown in the exploration window. So what we really do when we write a test using Pex is to make a “base test method” that is called with some input values in each of the actual tests:

 [TestMethod]
[PexGeneratedBy(typeof(ClassToBeTestedTest))]
[ExpectedException(typeof(ArgumentException))]
public void MethodToBeTestedThrowsArgumentException854()
{
    int i;
    ClassToBeTested s0 = new ClassToBeTested();
    i = this.MethodToBeTested(s0, 0, 0);
}
[TestMethod]
[PexGeneratedBy(typeof(ClassToBeTestedTest))]
public void MethodToBeTested8701()
{
    int i;
    ClassToBeTested s0 = new ClassToBeTested();
    i = this.MethodToBeTested(s0, 0, 1);
    Assert.AreEqual<int>(0, i);
    Assert.IsNotNull((object)s0);
}
[TestMethod]
[PexGeneratedBy(typeof(ClassToBeTestedTest))]
[ExpectedException(typeof(ArgumentException))]
public void MethodToBeTestedThrowsArgumentException688()
{
    int i;
    ClassToBeTested s0 = new ClassToBeTested();
    i = this.MethodToBeTested(s0, int.MinValue, 1);
}
 

You can see the that the values match the ones in the exploration window, and also the expected exceptions are checked.

So the real utility of Pex is that it automatically checks for problematic values, but from a “dumb” perspective, now we will use assumptions and assertions to check the “business” validity of our code by using parameterized tests.

To create a parameterized test you can use the option in the menu, or just copy the Pex Method giving it a different name. Once you have the new test method we will feed our method with certain values and then we will check the results.

No what we will do is to check that when “i” and “j” are positive values, the result of the division should be equal or greater than 0. So we will write this method:

 [PexMethod]
        public float MethodToBeTestedAssert(
            [PexAssumeUnderTest]ClassToBeTested target,
            int i,
            int j
        )
        {
            PexAssume.IsTrue(i > 0);
            PexAssume.IsTrue(j > 0);
            
            int result = target.MethodToBeTested(i, j);
            PexAssert.IsTrue(result>=0);
            return result;
            
        }
 

You can see we used the PexAssume objects, that instructs Pex about the valid values for the inputs, and we check the values using the PexAssert object.

To generate the code for this new Pex test, you can go to the tested method, right-click it and the select “Run Pex”

So let’s see how this modifies the Pex generated code:

First of all you need to select the appropriate test in the Pex exploration window:

Then you can see you have less inputs in this test than the ones in the automatic one, this is because you instructed Pex to use only greater that zero values in your inputs by using the PexAssume class. So Pex analyses the preconditions you give it to generate a test set.

 [TestMethod]
[PexGeneratedBy(typeof(ClassToBeTestedTest))]
public void MethodToBeTestedAssert868()
{
    float f;
    ClassToBeTested s0 = new ClassToBeTested();
    f = this.MethodToBeTestedAssert(s0, 1, 1);
    Assert.AreEqual<float>((float)1, f);
    Assert.IsNotNull((object)s0);
}
 

If you want to specify a custom value for an input parameter you can do two things, use a PexAssume statement or modify the input parameters of the method, for example this method:

 [PexMethod]
        public float MethodToBeTestedAssert(
            [PexAssumeUnderTest]ClassToBeTested target,          
            int j
        )
        {
            int i = 12;
            PexAssume.IsTrue(j >= 0);
 
            int result = target.MethodToBeTested(i, j);
            PexAssert.IsTrue(result >= 0);
            return result;
 
        }
 

Which receives only one parameter and assures it is greater or equal to 0, generates these inputs (note that there are no “i” parameter:

And the code is this:

 [TestMethod]
[PexGeneratedBy(typeof(ClassToBeTestedTest))]
[ExpectedException(typeof(ArgumentException))]
public void MethodToBeTestedAssertThrowsArgumentException325()
{
    float f;
    ClassToBeTested s0 = new ClassToBeTested();
    f = this.MethodToBeTestedAssert(s0, 0);
}
[TestMethod]
[PexGeneratedBy(typeof(ClassToBeTestedTest))]
public void MethodToBeTestedAssert632()
{
    float f;
    ClassToBeTested s0 = new ClassToBeTested();
    f = this.MethodToBeTestedAssert(s0, 1);
    Assert.AreEqual<float>((float)12, f);
    Assert.IsNotNull((object)s0);
}
 

Preconditions with Pex. Enhancing our code

Enrique Blanco — Sat, 20 Mar 2010 19:16:17 GMT

One of the advantages that Pex has is that it automatically reviews all the executing paths of the code you type, and so, it helps you in building a better, more defensive code.

For example, if we do a very simple function like this:

public int MethodToBeTested(int i, int j)
{
return i / j;
}

When you run Pex you get these three tests:

In the first one Pex detects that if you give “j” a value of zero it will raise a DivideByZero exception. A good practice for coding is that all public methods should check their input parameters for wrong values, so for this exception we will add a precondition.

So we will right-click over the first test and select “Add Precondition…” option:

You can see in the tooltip the code of the precondition, once we select the option we are presented a dialog where the code is displayed:

Once we click the “Apply” button, Pex modifies our code to check the values:

public int MethodToBeTested(int i, int j)
        {
            // <pex>
            if (j == 0)
                throw new ArgumentException("j == 0", "j");
            // </pex>
            return i / j;
        }

Then if we run Pex again on our code we can see that the first test is green, because our code checks properly the input parameter:

You can do the same for the other wrong test. Hope it helps ;-)

Starting with PEX

Enrique Blanco — Tue, 16 Mar 2010 23:03:37 GMT

Hi, this means to be the first of a series of posts about PEX and Moles. They conform a test suite intended to make life easier to the developers, they work on both VS2008 and VS2010, Acordding to their site:

Pex automatically generates test suites with high code coverage. Right from the Visual Studio code editor, Pex finds interesting input-output values of your methods, which you can save as a small test suite with high code coverage. Microsoft Pex is a Visual Studio add-in for testing .NET Framework applications.
Moles allows to replace any .NET method with a delegate. Moles supports unit testing by providing isolation by way of detours and stubs. The Moles framework is provided with Pex, or can be installed by itself as a Microsoft Visual Studio add-in.

So let’s start using Pex in a very very simple way, let’s give some advanced topics for later posts…

First of all you have to download and install the software from the download page.

After installing let’s create a new class library project, and add a class with a simple method, since Pex analyses your code, let’s put some different executions paths, in our function, two or three ifs would be enough.

Then over the function right click and select “Run Pex”:

You can see that the code, depending on the value of the i parameter, throws an exception, adds another parameter or subtracts the parameter values.

So we click over the “Run Pex” option and Pex asks which test framework are we going to use, so we’ll select the Visual Stuidio test framework:

So when you run click OK, it automatically creates some tests for you that take into account the different execution paths of the method being tested.

You can see it has created three tests and has calculated the expected results for each one, so we will run the tests (the green arrow in the upper of the Pex Exploration Results window):

You will see that the first one (the exception one) is marked red, so we will right click over it and tell Pex to allow that exception in this method with that input so you’ll see a window like this, and click ok:

After applying the changes, Pex has inserted an attribute in the tests it has generated to allow that exception in that specific test, now you can run the tests again:

So far so good, now let’s make some changes to the code, inserting another execution path:

To update the tests, simply right click over the code and select “Run Pex”, so the new test for the new execution path will be created (now there are four tests):

NOTE:

When first using Pex I came across this error:

System.IO.FileLoadException: Could not load file or assembly 'Microsoft.Z3, Version=2.0.30325.1, Culture=neutral, PublicKeyToken=9c8d792caae602a2' or one of its dependencies. The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log for more detail. (Exception from HRESULT: 0x800736B1)

The solution as seen in the forums was to manually install the Microsoft Visual C++ 2008 SP1 Redistributable Package.

Enjoy it! More posts on Pex and Moles coming soon!

Tools and Tips for HTML Integration

Enrique Blanco — Tue, 23 Feb 2010 22:16:00 GMT

One of our weak points usually is the design integration tasks, if you are lucky you can have a very skilled web designer that gives you a cool cross-browser compatible markup that fits perfectly in your application, but most of the times you’re lucky if the HTML works perfectly in the plain html file and almost never the designer will be able to integrate him/herself the design into an .aspx or moss template, so when you start integrating it with your controls the pain comes.

In our last Project we needed a IE6+ compatible site, complying with accessibility standards and had to make extensive html changes to fit that, in this post I’ll talk about some of the tools and tips we used to do that:

Tools

Internet Explorer Developer Toolbar / Firebug extension for Firefox : A must have, I personally prefer Internet Explorer’s developer toolbar, but firebug is also very useful. The main point about IE is a “condensed css view” in which you can see the precedence of the css styles that are applied to a certain element, and it’s very useful to debug. The point here is that when using these you can make quick css changes on the fly without really changing the css in the server, so the adjusting process is really fastened. The IE Developer toolbar is available for all the IE versions, but IE8 version is the best.
MultipleIE and things so: Designers love things like this, they let them quickly test the design in lots of browser versions but I don’t recommend using those! The problem is that javascript does not execute properly (for example moving webparts fails) and you can come across really weird problems. My recommendation is to download and use the Internet Explorer Application Compatibility VPC Images for IE6/IE7/IE8 from MS, a set of virtual machines with different IE versions and developer tools installed.
Expression Web Superpreview / Expression Web Superpreview for Internet Explorer: This is really cool to test it in multiple browsers. You can see the different views side by side and test the differences visually. It is very useful in case you can’t have the virtual machines. The Expresion Web is commercial software, the “for Internet Explorer” version is free, but only supports internet explorer.
TAW - Test de accesibilidad web (http://www.tawdis.net/): It is the “de facto” standard for accessibility testing in Spain, it can show you many errors and guidelines to make your site accessible.
Color contrast analyzer (executable & Firefox extension): A very useful tool to test if your color scheme complies with accessibility standards. Note that the FF version only tests for contrast between background color and text, it does not take into account the images..
CSS Frameworks: You can use something like blueprint or 960.gs, if the designer uses, for example, the 960gs templates when creating the site, you can save a HUGE amount of time in the integration phase. Once you have integrated, you can delete the classes you haven’t used, since it includes way more features than you usually use.

Documentation:

http://www.librosweb.es/ -> In Spanish, a very good css book.
http://www.w3.org/TR/CSS2/selector.html -> The css selector reference.
http://msdn.microsoft.com/en-us/library/ms533054(VS.85).aspx -> The best (D)HTML reference I’ve found

Some Automatic tools (untested):

http://browsershots.org/ It tests your site in lots of different browsers and shows you screenshots of the image. Good for fast testing.
http://www.onderhond.com/tools/ie6fixer. They claim that they automatically fix your css to work with IE6.
http://www.psd2html.com/ It’s not really automatic, you can use it, when, simply said, your designer does not know how to code XHTML properly (so common, so sad :().

Tips:

Use a dual monitor configuration if you can. The editor in one screen and the virtual machine/browser in the other, it will save you a lot of time.
Doctypes: Try to use the XHTML doctype, note: some doctype versions “have a problem” with the target attribute in anchors, use http://validator.w3.org to check for the validity of the markup.
Use the metatags for ie8 compatibility modes if necessary: http://msdn.microsoft.com/en-us/library/cc288325(VS.85).aspx
Use some reset css (for example: http://meyerweb.com/eric/tools/css/reset/ ): Different browsers assign different values to default tags, for example default padding, margin or font size, then when you try to integrate things do not fit exactly.
Use em for font sizes. Declare a font-size in your body for example a “75%”. And make all fonts relative to that size, so resizing the fonts in your page can be done by simply modifying that value.
Distribute your css files in a logical manner: Don’t use a single one, I used a reset, another for the grid layout, another for the main things, one specific for IE7 hacks and another for IE6 hacks My favorite would be to use only three: One that comprehends reset, grid layout and the main-standard things, one for the hacks for ie7 & one for ie6. IE8 is quite standard, so if you need a hack for it, try rethinking the way you’re doing that, and I’m sure that you will find a more css that works on IE, FF and Chrome. Seriously.

Disabling input validation in MVC2 using ASP.NET 4.0 (Part II)

Enrique Blanco — Sun, 21 Feb 2010 20:14:42 GMT

This is the second part of “Disabling input validation in MVC2 using ASP.NET 4.0”, in the first part we saw how to disable the input validation, to upload, for example, html code.

The problem with that is that we disabled the validation for all fields in the form, so all the other fields (that might not contain html) can be “hacked” with html code if you don’t notice.

So we need to protect them, and to be consistent with the rest of your application, let’s use the validation provide for ASP.NET by default.

If you use .NET Reflector, you’ll see that the input validation in ASP.NET 4.0 is done by the RequestValidator class, and by the protected “IsValidRequestString” Method, so we’ll create an inherited class called “CustomRequestValidator”:

 internal class CustomRequestValidator : System.Web.Util.RequestValidator
    {
        /// <summary>
        /// Validates a form parameter
        /// </summary>
        /// <param name="formParameter">The name of the parameter</param>
        /// <returns></returns>
        public bool IsValidFormParameter(string formParameter)
        {
            string fieldValue = HttpContext.Current.Request.Form[formParameter];
            int validationFailureIndex = 0;
            return base.IsValidRequestString(HttpContext.Current, fieldValue,
                System.Web.Util.RequestValidationSource.Form, formParameter,
                out validationFailureIndex);
        }
 
        /// <summary>
        /// Validates a querystring parameter
        /// </summary>
        /// <param name="formParameter">The name of the parameter</param>
        /// <returns></returns>
        public bool IsValidQueryStringParameter(string formParameter)
        {
            string fieldValue = HttpContext.Current.Request.QueryString[formParameter];
            int validationFailureIndex = 0;
            return base.IsValidRequestString(HttpContext.Current, fieldValue,
                System.Web.Util.RequestValidationSource.QueryString, formParameter,
                out validationFailureIndex);
        }
    }
 

As you can see we created two methods, one to validate form parameters and another to validate querystring ones.

So in our controller we just need to insert a code like this, to validate all parameters but the “html-ed” one:

 /// <summary>
        /// Validates form input
        /// </summary>
        private void CustomValidateRequest()
        {
            string campoHtml = "Description";
 
            WandauRequestValidator reqVal = new WandauRequestValidator();
            NameValueCollection nvCol = HttpContext.Request.Form;
            foreach (string key in nvCol.AllKeys)
            {
                if (!String.Equals(campoHtml, key, StringComparison.InvariantCultureIgnoreCase) &&
                    !reqVal.IsValidFormParameter(key))
                {
                    ModelState.AddModelError(key, "The field has invalid chars");
                }                
            }
        }
 

Note that the html-ed parameter is description and when we find an invalid input we add a model error instead of throwing an exception, so the page validation can alert the user of the misuse of the field.

Hope it helps!